Better Messages Plugin Auth and Authorization Bypass

Authorization bypass in the Better Messages - Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress (all versions up to and including 2.15.33) allows authenticated users with custom-level access or above to retrieve the full message transcript, thread metadata and participant user data of chat-room threads they are not members of. The root cause is a missing authorization check (CWE-862) on the plugin's REST endpoints, and exploitation is further gated on a target room's only_joined_can_read setting retaining its default value of '0' - rooms reconfigured to '1' are not affected. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N, confidentiality-only impact), this is a real but moderate-priority confidentiality issue rather than a critical emergency; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.

Unauthenticated attackers can impersonate the Better Messages plugin's own internal AI bot accounts on WordPress sites running versions up to and including 2.15.33, gaining entry to administrator-restricted chat rooms and reading the private message history of other users. The flaw is entirely pre-authentication (CVSS vector PR:N/UI:N) and requires only that unauthenticated guest registration is enabled and that the server forwards the client-supplied X-Real-IP header to the plugin, which stores it verbatim; the plugin's is_ai_bot_user() check then prefix-matches the attacker-chosen value against 'ai-chat-bot-'. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, but the low complexity and lack of any credential requirement make the issue straightforward to abuse where restricted rooms exist. The vendor-assigned score is 5.3 (Medium, C:L/I:N); our reassessment raises confidentiality to High and adds a Low integrity impact because the same bypass allows posting into restricted rooms, netting a materially higher severity than the published vector implies.